Re: [gentoo-dev] [PATCH 3/3] dev-vcs/hub: migrate to go-module.eclass

[Michael Orlitzky]

(Replying to both messages at once.)


On 9/13/19 4:17 PM, Patrick McLean wrote:
>>
> I don't think anyone here has suggested that any go packages are
> installed in the stage3 tarballs, or included in profiles. Something's
> presence in the tree does not mean that you are required to install it.
> A package's presence in the tree really has little to zero effect on
> any user that does not use the package. If you do not install the
> package, it will have zero effect on your banking.

This is true only so far as they never become dependencies of anything
else. Do all new developers know that dev-go is an insecure ghetto? Do
our users? Or might someone accidentally install or depend upon
something in dev-go before learning that crucial bit of information?


> I also want to point out that the Gentoo packages for Firefox,
> Chromium, and Webkit all have a _lot_ of bundled dependencies and
> absolutely do static linking internally. If you are using a browser to
> do your banking, you are almost certainly using static linking, even
> without the presence of code written in golang.

Is this is a "two wrongs make a right" argument? I'm telling mom =P


> Despite your (and my) objections to it's approach to linking, golang is
> a very popular language these days with some very popular packages
> written in it.

No it's not. It's below Delphi and Object Pascal on TIOBE this month.
It's a trend that a tiny percentage of people jumped on because they
heard the name "Google" back when Google was cool.

The "people want this in Gentoo" argument I understand, but people don't
really have it "in Gentoo." They have a thin wrapper around the "go"
command. They don't get the Gentoo security guarantees, they don't get
the Gentoo license handling, they don't get the ease of management that
comes with a Gentoo @world update. They silently get something less than
they're expecting. We would be better off telling people to run "go
whatever" themselves, or by putting this stuff in an overlay where
expectations are clearly defined.


> While I personally have opinions about static linking (I basically
> completely agree with you that it's a dumb idea). That said, this has
> nothing to do with this particular discussion, I suggest you take it up
> with the golang upstream. I don't think anyone here is arguing that
> static linking is a great idea and everyone should do it.

We just have a philosophical difference here. I don't think we should
commit admittedly-dumb ideas to ::gentoo. These packages would work fine
in an overlay until such a time as someone is interested in doing things
correctly. They also work "fine" if you install them with "go" yourself:
Portage isn't doing much for you when everything is bundled, statically
linked, and has LICENSE set incorrectly.

I don't want to keep replying to these threads -- I've said everything
that I've got to say, and I'm boring myself, so I can only imagine how
you all feel. This will get pushed through anyway, because it always
does. It's just demoralizing constantly begging people not to make
things worse and being ignored.